3

There is a desktop computer in our LAN that keeps booting almost every time seconds after it has been turned off manually.

I suspected it was a Wake-on-LAN issue since the beginning, and it looks like it: the problem disappears if the ethernet cable is disconnected before turning the computer off. Also, although the BIOS does not have an specific option to disable WOL, it has a power saving option that switches off the network card when the computer is not running, and this solves the problem too.

The thing is I cannot find who is sending WOL packets. I am sniffing the whole LAN with Wireshark using the capture filter "ether proto 0x0842 or udp", as suggested in http://wiki.wireshark.org/WakeOnLAN and it does not detect anything. But when I manually send WOL packets from different computers on the network Wireshark does catch these packets.

I don't see anything weird when capturing all traffic to and from this computer either.

UPDATE

This "Wake on Pattern Match" option is enabled on the computer. According to https://superuser.com/questions/560175/what-is-wake-on-pattern-match-in-network-card-preferences the default patterns are: magic packet, NetBIOS name query, TCPv4 SYN, TCPv6 SYN, IPv6 Neighbour Solicitation.

The other PCs have this option enable too, but they do not randomly wake up. I am going to check if this computer is receiving any of these.

Power Management options of the computer

Improve this question
8
  • If you aren't seeing WoL packets from within the same LAN, you may want to look elsewhere.
    – Ryan Foley
    Commented Nov 11, 2014 at 11:23
  • Where? It's the only LAN we have.
    – karmapolice
    Commented Nov 11, 2014 at 12:29
  • You should be looking at other possibilities (i.e. other problems). If you aren't seeing WoL packets on your LAN, but you see it when you send them, then it would seem that those aren't the source of your mysterious computer boot up issues. On a side note, I've never seen an application where you couldn't turn off WoL.
    – Ryan Foley
    Commented Nov 11, 2014 at 12:52
  • Don't forget about WoL over IPv6... Your wireshark filter might not see ipv6... I can't test it at the moment
    – Mike Pennington
    Commented Nov 11, 2014 at 12:56
  • The mysterious boot ups are prevented by removing the ethernet cable or switching off the network card. What else could it be?
    – karmapolice
    Commented Nov 11, 2014 at 13:02

3 Answers 3

Reset to default
6

Mystery solved.

The Windows 7 computer was continuously receiving TCP SYN packets to the 9100 port from another computer in the same LAN, waking up as a result when "Wake on Pattern Match" was activated.

This port is used by network printers. The IP of the Windows 7 computer belonged before to a long-time discarded HP printer.

The computer sending the packets is old, and it is always on as it is used sometimes to run software that only works in Windows XP. This computer still had the old network printer configured, pointing to the local IP address that now belongs to the Windows 7 computer having the problems. There were still documents in the printing queue, so the Windows XP computer was continuously sending TCP SYN packets to the Windows 7 computer, thinking it was the network printer. Removing the old printer from Windows XP and its associated TCP/IP Printer Port solved the problem.

I could not catch this traffic between both computers from mine using Wireshark. I had to install it on the affected computer and run it with promiscuous mode disabled.

Improve this answer
1
  • 1
    Nice solve. Thanks for sharing the resolution!
    – Eddie
    Commented Nov 17, 2014 at 17:00
1

Presumably listening in promiscuous mode on the entire LAN segment, without a filter, would produce too much traffic (otherwise, you could just do that).

If you have a hub a real hub, not a "switching hub", you could plug the computer that keeps waking up into one port on the hub, and plug your machine running Wireshark into another port, so that you're physically sniffing only the traffic to and from that machine. Then you could capture with no filter and, while the machine is asleep, presumably still not see a lot of traffic.

Improve this answer
0

A suggestion you might have already tried, but check to see if there is an updated driver for the NIC. You might even want to get the driver from the NIC manufacturer, if the computer manufacturer does not have one. A friend of my had problems with a new, out of the box Dell that was using an Intel NIC, and it was causing problems with bad packets until he got an updated driver installed.

You don't say which operating system you are using, but if it is Windows, check the Power Management setting for the NIC. Make sure to uncheck the "Allow this device to wake the computer" (or check the box to make sure only a magic packet wakes it). enter image description here

Improve this answer
2
  • I already have a solution via BIOS saving power feature, that completely switches off the network card when the PC is off.
    – karmapolice
    Commented Nov 12, 2014 at 6:12
  • But I am curious about how is this happening to this specific computer. I did not know there was another way to wake the computer through the network card other than magic packets via WoL. Any idea how is it done and how can I detect it?
    – karmapolice
    Commented Nov 12, 2014 at 6:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.